MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bb0715911b95a2b06f76628e6a9be5db826e3aeecb87e4d3ce3928d6eda2f7be. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bb0715911b95a2b06f76628e6a9be5db826e3aeecb87e4d3ce3928d6eda2f7be
SHA3-384 hash: c5ff4d2e07412ad6389b14da78af752e627e0e91434cab998e5a0320193dfbe54f3724f5441828c092f906388532c285
SHA1 hash: 6bd71878692974e9dd61521ca5f1772e7e914add
MD5 hash: c7bc9a8ed33902a1afb280e8828e7e11
humanhash: one-edward-fifteen-avocado
File name:PEMSB1066804061020.iso
Download: download sample
Signature AgentTesla
Create hunting rule
File size:516'096 bytes
First seen:2020-10-07 16:42:23 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 6144:9RAwnJ/0eSrnfZP2xlmE0+G16cSlYrZrpkVu+OjAaSN0HbJg9pzxAevs:DrKrnfkx30VyQpkVu+daS2+pzxAe0
TLSH A9B45C22123CC7BDC9490D37E0A546A78796A38A7065EABD9F2CFC9F7716702E0049E5
Reporter abuse_ch
Tags:AgentTesla iso


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: ahorrochile.cl
Sending IP: 45.88.3.137
From: Valeria Nuñez <vnunez@ahorrochile.cl>
Subject: Ahorrochile; QUOTATION: NEW INQUIRY PEMSB1066804061020 TOP URGENT
Attachment: PEMSB1066804061020.iso (contains "PEMSB1066804061020.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
114
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/bb0715911b95a2b06f76628e6a9be5db826e3aeecb87e4d3ce3928d6eda2f7be/
Threat name:
ByteCode-MSIL.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2020-10-07 16:44:07 UTC
AV detection:
7 of 48 (14.58%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=xmdrlei3swrla33wmkhgvg7f3obg4oxozod6ju6oheunn3nc667a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/bb0715911b95a2b06f76628e6a9be5db826e3aeecb87e4d3ce3928d6eda2f7be

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

iso bb0715911b95a2b06f76628e6a9be5db826e3aeecb87e4d3ce3928d6eda2f7be

(this sample)

AgentTesla

Executable exe 1baa8a9cf47869c0590889e4aa559db2539912a888adf183e7a56a756050f7cb

  
Dropping
MD5 295120aa43f8840484b314d94dfdf95d
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 1baa8a9cf47869c0590889e4aa559db2539912a888adf183e7a56a756050f7cb

Comments